Consumer Rights in Eldercare Monitoring AI: Transparency and Consent Rules in the UK

AI-based eldercare monitoring can include fall-detection cameras, movement sensors, voice monitoring, wearable devices, predictive health analytics and automated alerts. In the UK, these systems are subject to a combination of UK GDPR/data-protection rules, the Data Protection Act 2018, the Data (Use and Access) Act 2025 (DUAA), the Mental Capacity Act 2005 and health/social-care regulation.

1. Right to know that AI monitoring is being used

Care providers generally must explain to residents how their personal data is being processed. ICO guidance requires transparency about matters such as:

• what data is collected;
• why it is collected;
• how AI is used;
• how long data is retained;
• who receives or accesses it;
• whether data is used to train or improve AI systems; and
• the consequences of the processing.

This information should be provided at an appropriate time and in an understandable form.

For an elderly resident, merely stating “AI monitoring is used for safety” may therefore be inadequate where more explanation is needed to understand what is actually being monitored.

2. Consent is particularly important for intrusive monitoring

Consent under UK data-protection law must generally be freely given, specific, informed and unambiguous, involving a clear affirmative action. The individual must have a genuine choice.

This is especially significant where AI cameras or sensors operate inside a resident's private bedroom.

The ICO has specifically considered AI cameras in care-home bedrooms that detect falls. Its guidance indicates that consent cannot be valid if residents suffer a disadvantage for refusing. If a resident refuses, the camera may need to be capable of being turned off in that room; visitors and staff entering the room may also have consent/privacy implications.

3. Health information receives stronger protection

Eldercare AI can process information revealing a person's:

• physical or mental health;
• disabilities;
• medication patterns;
• mobility;
• falls;
• sleep patterns; or
• behavioural characteristics.

Such information can constitute special-category personal data, attracting additional protection.

Under the post-DUAA framework, significant decisions based on special-category information generally cannot be made solely through automated processing unless specific statutory conditions are satisfied, including explicit consent or certain contractual/legal and substantial-public-interest conditions.

4. AI cannot simply replace meaningful human judgement

The Data (Use and Access) Act 2025 changed the UK's rules on solely automated significant decisions. The framework is now more permissive than the previous Article 22 regime, but safeguards remain.

Where qualifying automated decision-making is used, organisations must provide appropriate safeguards including the ability for the person to:

• receive information about the decision;
• make representations;
• obtain human intervention; and
• contest the decision. 

For example, if an eldercare algorithm predicts that a resident is likely to fall and automatically changes their care arrangements, a provider should not treat the algorithm's output as unquestionable.

5. Mental capacity is a separate issue

Consent becomes more complicated where an older resident lacks mental capacity to make the particular decision.

CQC guidance states that care and treatment must generally be provided with the consent of the relevant person and that information must be communicated in a way the person can understand. The Mental Capacity Act framework requires capacity to be assessed appropriately rather than simply assuming incapacity because someone is elderly or has a cognitive impairment.

Therefore:

Old age itself does not eliminate the resident's right to decide.

Where capacity is absent, providers must follow the applicable Mental Capacity Act framework and consider the person's rights, wishes, feelings and best interests rather than treating family consent as an automatic substitute.

6. Family members do not automatically control the resident's data rights

A relative may assist an elderly person, but being a son, daughter or other family member does not automatically give that person unrestricted authority to consent to AI surveillance.

The provider must determine:

1. whether the resident has capacity;
2. whether the resident has provided valid consent;
3. whether someone has lawful authority to act on the resident's behalf; and
4. whether another lawful basis is being relied upon.

This distinction is particularly important where families request continuous camera monitoring for reassurance.

7. Right to challenge AI-generated decisions

Where AI makes or materially contributes to a significant decision, the resident should have meaningful mechanisms for questioning the result.

The ICO's AI guidance emphasises meaningful explanations, human involvement and the ability to contest relevant automated decisions.

For example, if an AI system incorrectly identifies:

“resident is wandering / confused / at high fall risk”

and that prediction results in restrictions on movement or changes to care, the resident or their lawful representative should have a meaningful route to challenge the assessment.

8. Data minimisation and privacy

Eldercare providers should avoid collecting more information than necessary.

A system designed merely to detect falls may not automatically justify:

• continuous recording of conversations;
• facial recognition;
• indefinite video retention;
• recording every visitor;
• behavioural profiling for unrelated purposes.

The ICO's AI framework emphasises fairness, transparency, accountability and data minimisation.

A privacy-by-design approach is therefore important: collect the minimum information necessary, restrict access and establish appropriate deletion/retention periods.

9. Data Protection Impact Assessment

AI monitoring of vulnerable elderly people can involve significant privacy risks, particularly where there is systematic monitoring, profiling or sensitive health information.

A Data Protection Impact Assessment (DPIA) may therefore be required before deployment. ICO guidance states that systematic and extensive profiling or automated evaluation producing legal or similarly significant effects requires a DPIA.

For high-risk eldercare surveillance, the DPIA should consider issues such as:

• dignity and autonomy;
• proportionality;
• bedroom/bathroom privacy;
• false positives and false negatives;
• discrimination or bias;
• cybersecurity;
• data retention;
• family/visitor privacy;
• human oversight; and
• consequences of refusing monitoring.

10. Key consumer-rights issues

11. Important UK legal/regulatory framework

The principal framework includes:

• UK GDPR — transparency, lawfulness, fairness, data minimisation, individual rights and special-category data.
• Data Protection Act 2018 — supplements the UK GDPR and provides additional data-protection rules.
• Data (Use and Access) Act 2025 — significantly changes the UK's automated decision-making framework while retaining safeguards, particularly for special-category data. 
• Mental Capacity Act 2005 — relevant where an elderly resident may lack capacity to consent to monitoring or care decisions.
• Health and Social Care Act 2008 / CQC regulatory framework — relevant to regulated adult social-care providers.
• Common-law duties of confidentiality and privacy — potentially relevant where monitoring involves confidential health information.

Conclusion

The central UK legal principle is that eldercare safety does not automatically override an older person's autonomy and privacy. AI monitoring should be proportionate, transparent and properly governed. Where consent is relied upon, it must be genuine and informed; where health information is processed, additional safeguards apply; and where AI makes significant decisions, the post-DUAA framework requires appropriate safeguards such as information, representations, human intervention and challenge.

For disputes, the strongest issues are likely to concern invalid consent, inadequate transparency, excessive surveillance, misuse of health data, lack of meaningful human oversight, inaccurate AI predictions, failure to respect mental-capacity requirements, and unlawful sharing or retention of monitoring data.